Privacy policy

1. Who is responsible for your data?

Solo Business Ai is the data controller for account administration, site operations, support and security. Contact our privacy team at solobusinessai1@gmail.com.

When a business uses its receptionist to collect customer conversations, leads or booking requests, that business normally acts as the controller and we process that information on its behalf to provide the service. Contact that business first about its use of your information; we can assist with identifying it and forwarding requests.

2. Information, purposes and legal bases

• Account information: name, email, authentication identifiers and credentials handled by our authentication provider, and business profile/contact details. We use these to create accounts, authenticate you and provide the service (performance of a contract); secure access and prevent abuse (legitimate interests).
• Business and customer content: services, hours, FAQs, website information you ask us to import, chat messages, selected language, lead contact details and appointment requests. We process these to deliver the receptionist, answer questions and send requests to the business (contract performance for account holders; business instructions for customer content). The business is responsible for its own lawful basis and notices.
• Support communications: email address, messages and information you provide when seeking help. We use these to respond and resolve problems (contract performance or legitimate interests in assisting visitors).
• Technical data: IP address, hashed IP identifiers for abuse limits, request identifiers, browser/device information, language preferences and operational/error logs. We use these for security, fraud prevention, troubleshooting and service reliability (legitimate interests in a safe, functioning service). Browser storage supports login, preferences and chat continuity.
• Subscription records: Paddle customer and subscription identifiers, plan, status, billing period and transaction references. We use these to manage access, reconcile billing and meet legal obligations (contract performance and legal obligation). Paddle collects and processes payment details under its own privacy notice; we do not store full card details.

We do not currently use your data for targeted advertising or set optional marketing/analytics cookies in the application. If we introduce consent-based uses, we will explain them and obtain consent where required.

3. Who receives information?

We share only information needed for the relevant purpose with the following categories of recipients:

• Hosting, database, authentication and infrastructure providers, including Lovable Cloud; support and email providers when responding to you.
• AI service providers: OpenRouter and the model provider selected through it process receptionist prompts and business/customer content needed to generate replies. The in-app billing assistant uses Lovable AI Gateway and its model provider to process your question and the relevant linked subscription/invoice details. Do not include unnecessary sensitive information in prompts.
• Paddle, our Merchant of Record, for product sales, subscription management, payments, tax compliance, invoicing, cancellations and refunds. Paddle acts under its own Privacy Policy.
• The business operating the receptionist receives its customers’ messages, lead details and appointment requests. Assistants you explicitly authorise may read the account information covered by the access you grant; you can revoke that authorisation.
• Professional advisers, such as legal and accounting advisers, where needed; authorities when disclosure is required by law, or to protect legal rights and prevent fraud.

AI providers process information under their applicable terms and privacy practices. We do not sell your personal data.

4. International transfers

Some hosting, AI and other service providers may process data outside Greece or the European Economic Area. Where GDPR requires a transfer safeguard, we use an applicable adequacy decision or appropriate contractual safeguards, such as the European Commission’s Standard Contractual Clauses, with additional measures where necessary. You can contact us for information about the safeguards applicable to your data.

5. How long do we keep data?

Account and business information is retained while needed to operate your account. Conversations, leads and appointment requests are kept while needed by the business to provide and follow up on the service, until deleted or a valid deletion request is fulfilled, subject to legal requirements. Cancelling a subscription does not automatically delete this information.

Support correspondence and security logs are retained only as necessary to resolve requests, investigate abuse and protect the service. Billing and legal records are kept for the applicable statutory retention period. The period depends on the purpose, account status, applicable Greek/EU requirements and any unresolved dispute. We delete or anonymise personal data when no longer needed; backups may remain until their normal replacement cycle and are not used for ordinary operations. Contact us for retention details or a deletion request.

6. Your GDPR rights

Subject to applicable exceptions, you may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. We do not make solely automated decisions with legal or similarly significant effects about you through the receptionist.

Email solobusinessai1@gmail.com to exercise your rights. We may need to verify your identity. We respond within one month; for complex or numerous requests, GDPR permits an extension of up to two further months, and we will explain the extension within the first month.

You may complain to the Hellenic Data Protection Authority or your local supervisory authority. Please contact us if you would like us to address a concern first.

7. Security and browser storage

We use appropriate technical and organisational measures, including encrypted connections, access controls and account-scoped access restrictions. Access is limited to those who need it to provide the service. No system is completely secure; protect your login details and avoid submitting unnecessary sensitive information.

See our Cookie Policy for essential storage, language preferences, chat continuity and how to clear or control them.

8. Updates and contact

We update this notice when practices or legal requirements change and will communicate material changes where appropriate. For privacy questions, contact Solo Business Ai, Greece, at solobusinessai1@gmail.com.